Continuing our threat modeling exercises for our DVR, we will work on breaking down its web applications. Our DVR contains two types of web applications. One web application is embedded, running off of the DVR itself. The second web application is a SaaS application provided by the vendor for remote access to the DVR and its camera feeds.
The SaaS application accesses the embedded DVR within the LAN. We have a better sense of what runs on the embedded web application locally on the DVR rather than the vendor SaaS application. Earlier in the chapter, we did mention some technologies utilized for the vendor web application but no additional information is known at this time. We will start by drawing out the architecture of the embedded web application and touch on the vendor SaaS application in the threats section rather than drawing its unknown architecture.